soda88 Privacy Policy

1 Introduction

soda88 ("soda88", "we", "us" or "our") is committed to protecting the privacy and personal data of every individual who accesses or uses the soda88 platform located at https://soda88.lat ("Platform"). This Privacy Policy ("Policy") sets out, in clear and formal terms, how soda88 collects, uses, stores, discloses, transfers and ultimately deletes or anonymises personal data provided by users ("you", "your" or "User") in connection with any account, transaction, support interaction or service experience on the Platform.

This Policy applies to all current and former registered users of soda88 and to individuals who access the Platform without creating an account, including visitors from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam and all other locations across Malaysia.

By accessing the Platform, creating a soda88 account or providing any personal information to us, you acknowledge that you have read and understood this Policy and agree to the data practices described herein. This Policy should be read alongside the soda88 Terms & Conditions.

2 Definitions

The following terms carry the meanings assigned below throughout this Policy:

3 Personal Data We Collect

soda88 collects Personal Data through several channels, including account registration forms, KYC verification submissions, payment transactions, support communications and automatic technical collection when you use the Platform. The categories of data we may collect include:

soda88 does not knowingly collect sensitive personal data beyond the KYC categories described above unless a specific regulatory obligation requires it. Where sensitive data is collected, additional safeguards apply.

4 Lawful Basis for Processing

soda88 processes Personal Data only where a lawful basis exists. The applicable bases under which soda88 relies for different categories of processing include the following:

• Contractual necessity: Processing required to register a soda88 account, authenticate login sessions, process deposits and withdrawals, and manage bonus claims on your behalf.
• Legal obligation: Processing required to comply with applicable anti-money-laundering regulations, identity verification obligations, fraud-prevention requirements and any regulatory reporting obligations.
• Legitimate interests: Processing for fraud detection, platform security monitoring, responsible gambling analysis and improving the performance and features of the soda88 Platform, provided such interests are not overridden by your data protection rights.
• Consent: Processing for direct marketing communications, non-essential cookies and certain analytics where you have provided explicit prior consent. You may withdraw consent for marketing at any time.

5 How We Use Your Data

The Personal Data soda88 collects is used for the following purposes:

• Registering and managing your soda88 account, including authenticating your identity at login.
• Processing deposit and withdrawal transactions through supported Malaysian payment channels including Boost, GrabPay, CIMB, Public Bank, Hong Leong, DuitNow and FPX.
• Conducting KYC identity verification and ongoing customer due diligence in line with anti-money-laundering obligations.
• Administering bonus offers, promotional rewards, birthday benefits and referral programmes to your account.
• Providing customer support and responding to account, payment or responsible-gambling enquiries.
• Detecting, investigating and preventing fraud, collusion, account abuse and other prohibited activities.
• Sending transactional communications — such as account notifications, withdrawal confirmations and security alerts — which are necessary for service delivery.
• Sending marketing communications about soda88 promotions, new features and relevant offers, subject to your consent or the applicable legitimate-interests basis.
• Analysing aggregate usage patterns to improve Platform performance, content relevance and responsible-gambling tools.
• Complying with applicable legal obligations, including responding to lawful requests from competent authorities.

6 Disclosure to Third Parties

soda88 does not sell, rent or trade Personal Data to third parties for their own marketing purposes. We may disclose your Personal Data to the following categories of recipients only as necessary and subject to appropriate safeguards:

• Payment service providers: To process deposits and withdrawals through supported Malaysian channels. These providers process your payment data solely for transaction purposes and are contractually bound to data security standards.
• Identity verification partners: To conduct KYC checks and document validation in line with regulatory obligations. Data shared is limited to what is strictly required for verification.
• Cloud and infrastructure providers: Third-party hosting and data storage services used to operate the soda88 Platform securely.
• Analytics and security providers: Service providers supporting fraud detection, Platform performance monitoring and user behaviour analytics on an aggregated or pseudonymised basis.
• Regulatory and legal authorities: Where required by applicable law, court order or regulatory direction, soda88 may disclose Personal Data to competent authorities including law enforcement agencies or financial intelligence units.

All third-party recipients are required to implement appropriate technical and organisational measures to protect the Personal Data they receive and to process it only in accordance with soda88's instructions or applicable legal requirements.

7 Cookies and Tracking Technologies

The soda88 Platform uses cookies and similar technologies to support essential platform functions, maintain session security and, where you have provided consent, to collect analytical data about how the Platform is used. The main categories of cookies used are:

• Strictly necessary cookies: These are required for the Platform to function and cannot be disabled. They include session authentication tokens, security tokens and load-balancing cookies. No consent is required for these.
• Functional cookies: These remember your account preferences, language settings and previously selected payment options to improve your return experience.
• Analytical cookies: Subject to your consent, these collect aggregated information about page visits, session durations and feature usage to help soda88 improve the Platform.

You can manage non-essential cookie preferences through your browser settings. Disabling certain cookies may limit the functionality available to you on the soda88 Platform.

8 Data Retention

soda88 retains Personal Data for as long as is necessary to fulfil the purposes set out in this Policy, or as required by applicable legal and regulatory obligations. The general retention principles applied are as follows:

• Active account data: Retained for the duration of the account relationship plus the applicable post-closure retention period required by regulation — typically five to seven years in jurisdictions subject to anti-money-laundering frameworks.
• KYC documents: Retained for the minimum period specified by applicable identity verification and financial crime prevention regulations following account closure.
• Transaction records: Retained for the period required by applicable financial reporting and anti-money-laundering obligations.
• Support communications: Retained for a reasonable period to allow dispute resolution and quality review, after which they are deleted or anonymised.
• Marketing consent records: Retained until consent is withdrawn and a reasonable period thereafter to demonstrate compliance.

When retention requirements lapse, Personal Data is securely deleted or irreversibly anonymised so that it can no longer be linked to an identifiable individual.

9 Security Measures

soda88 implements reasonable technical and organisational measures to protect Personal Data against unauthorised access, disclosure, alteration or destruction. These measures include:

• HTTPS encryption for all data transmitted between your browser and the soda88 Platform.
• Access controls restricting internal staff access to Personal Data on a need-to-know basis.
• Secure credential storage practices including hashing of account passwords.
• Monitoring systems for unusual account activity, suspicious login attempts and potential fraud indicators.
• Periodic security reviews of Platform infrastructure and data handling procedures.

Users share responsibility for account security. You should use a unique, strong password for your soda88 account, avoid using shared or public devices to access your account and contact soda88 support immediately if you suspect any unauthorised activity. soda88 will never ask you to share your password, one-time banking code or full payment card number through a chat or email channel.

10 User Rights

Subject to applicable data protection legislation and any overriding legal obligations, soda88 acknowledges the following rights in respect of your Personal Data:

• Right of access: You may request a copy of the Personal Data soda88 holds about you and information about how it is processed.
• Right to rectification: You may request correction of inaccurate or incomplete Personal Data. You may also update certain account details directly through your soda88 account settings.
• Right to erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to soda88's legal retention obligations. Active accounts with outstanding balances or unresolved investigations may not qualify for immediate erasure.
• Right to restrict processing: You may request that soda88 limits the processing of your Personal Data in specific circumstances, such as where you contest the accuracy of the data or object to a particular use.
• Right to data portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request a copy of your Personal Data in a structured, machine-readable format.
• Right to withdraw consent: Where soda88 relies on your consent as the lawful basis for processing — such as for direct marketing — you may withdraw that consent at any time by contacting soda88 support or using any unsubscribe mechanism provided in marketing communications.
• Right to object: You may object to processing based on legitimate interests where your own interests or fundamental rights override the basis cited by soda88.

To exercise any of these rights, please contact soda88 at the address provided in Clause 14. soda88 will acknowledge your request within a reasonable time and endeavour to respond substantively within the period required by applicable law. Verification of your identity may be required before a request can be actioned.

11 Children and Minors

The soda88 Platform and all associated Services are intended exclusively for adults aged 21 years and above. soda88 does not knowingly collect Personal Data from individuals below this age threshold.

If soda88 becomes aware that Personal Data has been submitted by an individual who is under the minimum age, the relevant account and all associated data will be closed and deleted without notice. If you have reason to believe that a minor has accessed soda88 Services, please contact us immediately at the address in Clause 14.

Account holders are responsible for ensuring that their login credentials are not accessible to minors residing in or visiting the same household.

12 International Data Transfers

Personal Data collected by soda88 may be stored on or processed by servers located outside Malaysia where soda88's infrastructure or service providers operate. In such cases, soda88 applies appropriate safeguards to protect the data in transit and at rest, including contractual clauses that impose equivalent data protection standards on the receiving party.

By using the soda88 Platform, you acknowledge that your Personal Data may be transferred to, stored in and processed in jurisdictions outside your own. Where such transfers involve financial data processed through Malaysian payment partners — including DuitNow, FPX or participating banks — those transfers are governed by the applicable Malaysian payment network rules and the payment provider's own privacy commitments.

13 Amendments to This Policy

soda88 reserves the right to modify this Privacy Policy at any time. When substantive changes are made, soda88 will publish the updated Policy on this page and update the "Last Reviewed" date at the top of the document. Where changes materially affect the way Personal Data is processed, soda88 will endeavour to provide prominent notice on the Platform prior to the changes taking effect.

Continued use of the soda88 Platform after any revision to this Policy constitutes your acknowledgement of and agreement to the updated terms. If you do not agree with a proposed change, you should stop using the Platform and may request account closure.

14 Contact Us

For any enquiry, request or formal complaint relating to this Privacy Policy or the processing of your Personal Data by soda88, please contact us using the details below. soda88 endeavours to acknowledge all written data-related enquiries promptly and to provide a substantive response within the period required by applicable law.

Website email: [email protected]

When submitting a data rights request, please include your full registered name and the email address associated with your soda88 account so that your identity can be verified efficiently. soda88 may request additional verification before actioning a sensitive data request.